Commit message (Collapse) | Author | Age | Files | Lines | |
---|---|---|---|---|---|
* | testing: Fix firewall rule on alice in tnc/tnccs-20-pdp-pt-tls scenario | Tobias Brunner | 2016-06-17 | 1 | -2/+2 |
| | |||||
* | testing: Build hostapd from sources | Tobias Brunner | 2016-06-16 | 3 | -1/+78 |
| | | | | | | | | There is a bug (fix at [1]) in hostapd 2.1-2.3 that let it crash when used with the wired driver. The package in jessie (and sid) is affected, so we build it from sources (same, older, version as wpa_supplicant). [1] http://w1.fi/cgit/hostap/commit/?id=e9b783d58c23a7bb50b2f25bce7157f1f3 | ||||
* | testing: Update download URL for wpa_supplicant | Tobias Brunner | 2016-06-16 | 1 | -1/+1 |
| | |||||
* | testing: Wait for packets to be processed by tcpdump | Tobias Brunner | 2016-06-16 | 1 | -1/+10 |
| | | | | | | | | | | | | | | | | | | | | | | | | | | Sometimes tcpdump fails to process all packets during the short running time of a scenario: 0 packets captured 18 packets received by filter 0 packets dropped by kernel So 18 packets were captured by libpcap but tcpdump did not yet process and print them. This tries to use --immediate-mode if supported by tcpdump (the one currently in jessie or wheezy does not, but the one in jessie-backports does), which disables the buffering in libpcap. However, even with immediate mode there are cases where it takes a while longer for all packets to get processed. And without it we also need a workaround (even though the version in wheezy actually works fine). That's why there now is a loop checking for differences in captured vs. received packets. There are actually cases where these numbers are not equal but we still captured all packets we're interested in, so we abort after 1s of retrying. But sometimes it could still happen that packets we expected got lost somewhere ("packets dropped by kernel" is not always 0 either). | ||||
* | testing: Fix expect-connection for tkm tests | Tobias Brunner | 2016-06-16 | 1 | -1/+1 |
| | | | | We don't use swanctl there but there is no load statement either. | ||||
* | testing: Add expect-connection calls for all tests and hosts | Tobias Brunner | 2016-06-16 | 184 | -11/+236 |
| | | | | There are some exceptions (e.g. those that use auto=start or p2pnat). | ||||
* | testing: Update test scenarios for Debian jessie | Tobias Brunner | 2016-06-16 | 289 | -576/+576 |
| | | | | | | | The main difference is that ping now reports icmp_seq instead of icmp_req, so we match for icmp_.eq, which works with both releases. tcpdump now also reports port 4500 as ipsec-nat-t. | ||||
* | testing: Fix posttest.dat for ikev2/rw-dnssec scenario | Tobias Brunner | 2016-06-16 | 1 | -6/+6 |
| | |||||
* | testing: Make sure tcpdump is actually terminated before ↵ | Tobias Brunner | 2016-06-16 | 1 | -11/+6 |
| | | | | analyzing/collecting logs | ||||
* | testing: Correctly dis-/enable services with systemd | Tobias Brunner | 2016-06-16 | 2 | -4/+16 |
| | |||||
* | testing: Install packages like the FIPS-enabled OpenSSL from a custom apt repo | Tobias Brunner | 2016-06-16 | 3 | -14/+28 |
| | |||||
* | testing: Update base image to Debian jessie | Tobias Brunner | 2016-06-15 | 3 | -10/+30 |
| | | | | | | | | | | | | | Several packages got renamed/updated, libgcrypt was apparently installed by default previously. Since most libraries changed we have to completely rebuild all the tools installed in the root image. We currently don't provide a clean target in the recipes, and even if we did we'd have to track which base image we last built for. It's easier to just use a different build directory for each base image, at the cost of some additional disk space (if not manually cleaned). However, that's also the case when updating kernel or software versions. | ||||
* | testing: Update 4.x kernel configs to be compatible with Debian 8/systemd | Tobias Brunner | 2016-06-15 | 6 | -13/+130 |
| | |||||
* | testing: Add root to fstab | Tobias Brunner | 2016-06-15 | 1 | -0/+1 |
| | | | | This seems to be required for systemd to remount it. | ||||
* | testing: Update Apache config for newer Debian releases | Tobias Brunner | 2016-06-15 | 9 | -62/+103 |
| | | | | | | It is still compatible with the current release as the config in sites-available will be ignored, while conf-enabled does not exist and is not included in the main config. | ||||
* | testing: Explicitly enable RC4 in SSH server config | Tobias Brunner | 2016-06-15 | 1 | -0/+1 |
| | | | | | | Newer OpenSSH versions disable this by default because it's unsafe. Since this is not relevant for our use case we enable it due to its speed. | ||||
* | testing: Add script to chroot into an image | Tobias Brunner | 2016-06-15 | 1 | -0/+67 |
| | | | | | If changes are made to the base or root image the images depending on these have to be rebuilt. | ||||
* | testing: Add a patch to tnc-fhh that avoids building the tncsim package | Tobias Brunner | 2016-06-15 | 2 | -1/+20 |
| | | | | This sub-package does not build on Debian jessie. | ||||
* | testing: Don't attempt to stop services when building base image | Tobias Brunner | 2016-06-15 | 1 | -2/+0 |
| | | | | | | Unlike `apt-get install` in a chroot debootstrap does not seem to start the services but stopping them might cause problems if they were running outside the chroot. | ||||
* | testing: Fix scenarios that check /etc/resolv.conf | Tobias Brunner | 2016-06-13 | 3 | -6/+6 |
| | |||||
* | testing: Changed gcrypt-ikev1 scenarios to swanctl | Andreas Steffen | 2016-05-15 | 20 | -126/+148 |
| | |||||
* | testing: wait until connections are loaded | Andreas Steffen | 2016-05-15 | 98 | -89/+178 |
| | |||||
* | swanctl: Do not display rekey times for shunts | Andreas Steffen | 2016-05-05 | 1 | -0/+1 |
| | |||||
* | testing: Use reauthentication and set CHILD_SA rekey time, bytes and packets ↵ | Andreas Steffen | 2016-05-04 | 2 | -0/+8 |
| | | | | limits | ||||
* | testing: uses xauth_id in swanctl/xauth-rsa scenario | Andreas Steffen | 2016-05-04 | 4 | -6/+8 |
| | |||||
* | testing: Use absolute path of imv_policy_manager | Andreas Steffen | 2016-04-26 | 8 | -8/+9 |
| | |||||
* | testing: -D and -u options in sfdisk are not supported any more | Andreas Steffen | 2016-04-26 | 1 | -1/+1 |
| | |||||
* | testing: updated testing.conf | Andreas Steffen | 2016-04-24 | 4 | -3/+7000 |
| | |||||
* | testing: Added swanctl/rw-multi-ciphers-ikev1 scenario | Andreas Steffen | 2016-04-12 | 11 | -0/+238 |
| | |||||
* | testing: Added swanctl/manual_prio scenario | Andreas Steffen | 2016-04-09 | 11 | -0/+277 |
| | |||||
* | testing: Add swanctl/net2net-gw scenario | Tobias Brunner | 2016-04-09 | 11 | -0/+204 |
| | |||||
* | testing: List conntrack table on sun in ikev2/host2host-transport-connmark ↵ | Tobias Brunner | 2016-04-06 | 1 | -0/+1 |
| | | | | scenario | ||||
* | testing: Version bump to 5.4.0 | Tobias Brunner | 2016-04-06 | 1 | -1/+1 |
| | | | | References #1382. | ||||
* | testing: Disable leak detective when generating CRLs | Tobias Brunner | 2016-04-06 | 1 | -0/+4 |
| | | | | | | | | | GnuTLS, which can get loaded by the curl plugin, does not properly cleanup some allocated memory when deinitializing. This causes invalid frees if leak detective is active. Other invalid frees are related to time conversions (tzset). References #1382. | ||||
* | testing: Updated updown scripts in libipsec scenarios to latest version | Tobias Brunner | 2016-03-23 | 11 | -0/+341 |
| | |||||
* | Updated swanctl/rw-psk-ikev1 scenario | Andreas Steffen | 2016-03-10 | 5 | -28/+36 |
| | |||||
* | testing: Add ikev2/reauth-mbb-revoked scenario | Tobias Brunner | 2016-03-10 | 9 | -0/+105 |
| | |||||
* | testing: Generate a CRL that has moon's actual certificate revoked | Tobias Brunner | 2016-03-10 | 1 | -0/+3 |
| | |||||
* | testing: Added swanctl/mult-auth-rsa-eap-sim-id scenario | Andreas Steffen | 2016-03-06 | 20 | -0/+335 |
| | |||||
* | testing: Added swanctl/xauth-rsa scenario | Andreas Steffen | 2016-03-06 | 11 | -0/+211 |
| | |||||
* | testing: attr-sql is a charon plugin5.4.0dr8 | Andreas Steffen | 2016-03-05 | 11 | -42/+10 |
| | |||||
* | testing: Added swanctl/rw-psk-ikev1 scenario | Andreas Steffen | 2016-03-05 | 11 | -0/+271 |
| | |||||
* | testing: Include IKE port information in evaltests | Andreas Steffen | 2016-03-05 | 68 | -238/+221 |
| | |||||
* | testing: Add ikev2/redirect-active scenario | Tobias Brunner | 2016-03-04 | 20 | -0/+322 |
| | |||||
* | testing: Added swanctl/protoport-range scenario | Andreas Steffen | 2016-03-04 | 9 | -0/+159 |
| | |||||
* | libhydra: Remove empty unused library | Tobias Brunner | 2016-03-03 | 11 | -11/+11 |
| | |||||
* | testing: Added swanctl/shunt-policies-nat-rw | Andreas Steffen | 2016-02-28 | 12 | -0/+231 |
| | |||||
* | testing: Some minor fixes in test scenarios | Andreas Steffen | 2016-02-28 | 2 | -0/+3 |
| | |||||
* | testing: Added swanctl/protoport-dual scenario | Andreas Steffen | 2016-02-28 | 9 | -0/+142 |
| | |||||
* | testing: converted af-alg scenarios to swanctl | Andreas Steffen | 2016-02-26 | 25 | -149/+198 |
| |